Splunk Enterprise

Comparison of details

luckyman80
Path Finder

Hi Experts,

                        I wondered the best way of comparing the below data.  So I have a query which returns as so .

index=myindex sourcetype=mysourcetype host="myhost" |table process, tier, country

This returns a 100 or so processes their tier and country as expected.  There is only 4 countries  uk, usa, denmark and spain

It returns something like this 

process              tier              country

process1          roman         uk

process2          roman         usa

Process3         roman          Denmark

process4         anglo            uk

process5       anglo              usa

process6       anglo             Denmark

process7       anglo             spain

The roman tier should be present in each country . If Spain is missing as above how to I only show the missing entry for spain as the outlier ? This is basically for a rec purpose so we can see whats missing.

thanks in advance ! 

 

 

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| chart count by country tier
| where roman=0

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart count by country tier
| where roman=0
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...